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A  BILL 

To  provide  for  the  establishment  of  a  modernized  and  sim- 
plified health  information  network  for  medicare  and  med- 
icaid, and  for  other  purposes. 

1  Be  it  enacted  by  the  Senate  and  House  of  Represent a- 

2  tives  of  the  United  States  of  America  in  Congress  assembled, 

3  SECTION  1.  SHORT  TITLE;  TABLE  OF  CONTENTS. 

4  (a)  Short  Title. — This  Act  may  be  cited  as  the 

5  "Health  Information  Modernization  and  Security  Act". 

6  (b)  Table  of  Contents. — The  table  of  contents  is 

7  as  follows: 

Sec.  1.  Short  title;  table  of  contents. 
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TITLE  I— PURPOSE  AND  REPEAL  OF  DATA  BANK 

Sec.  101.  Purpose. 

Sec.  102.  Repeal  of  data  bank. 

TITLE  II— ADMINISTRATIVE  SIMPLIFICATION 

Sec.  201.  Administrative  simplification. 

TITLE  III— EFFECTIVE  DATES 

Sec.  301.  Effective  dates. 

1  TITLE  I— PURPOSE  AND  REPEAL 

2  OF  DATA  BANK 

3  SEC.  101.  PURPOSE. 

4  It  is  the  purpose  of  this  Act  to  improve  the  medicare 

5  program  under  title  XVIII  of  the  Social  Security  Act,  the 

6  medicaid  program  under  title  XLX  of  such  Act,  and  the 

7  efficiency  and  effectiveness  of  the  health  care  system,  by 

8  encouraging  the  development  of  a  health  information  net- 

9  work  through  the  establishment  of  standards  and  require- 

10  ments  for  the  electronic  transmission  of  certain  health  in- 

1 1  formation. 

1 2  SEC.  102.  REPEAL  OF  DATA  BANK. 

13  (a)  In  General. — Section  1144  of  the  Social  Secu- 

14  rity  Act  (42  U.S.C.  1320b-14)  and  section  101(f)  of  the 

15  Employee  Retirement  Income  Security  Act  of  1974  (29 

16  U.S.C.  1021(f))  are  repealed. 

17  (b)  Internal  Revenue  Code  Provision. — Section 

18  6103(0  of  the  Internal  Revenue  Code  of  1986  is  amended 

19  by  striking  paragraph  (12). 
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1  (c)  Identification  of  Medicare  Secondary 

2  Payer  Situations. — Section  1862(b)  of  the  Social  Secu- 

3  rity  Act  (42  U.S.C.  1395y(b))  is  amended  by  striking 

4  paragraph  (5). 

5  (d)  Conforming  Amendments. — 

6  (1)  Section  1902(a)(25)(A)(i)  of  the  Social  Se- 

7  curity  Act  (42  U.S.C.  1396a(a)(25)(A)(i))  is  amend- 

8  ed  by  striking-  "including  the  use  of  information  col- 

9  lected  by  the  Medicare  and  Medicaid  Coverage  Data 

10  Bank  under  section  1144  and  any  additional  meas- 

11  ures". 

12  (2)  Subsection  (a)(8)(B)  of  section  552a  of  title 

13  5,  United  States  Code,  is  amended — 

14  (A)  in  clause  (v),  by  inserting  ";  or"  at  the 

15  end; 

16  (B)  in  clause  (vi),  by  striking  "or"  at  the 

17  end;  and 

18  (C)  by  striking  clause  (vii). 

19  TITLE  II— ADMINISTRATIVE 

20  SIMPLIFICATION 

2 1  SEC.  201.  ADMINISTRATIVE  SIMPLIFICATION. 

22  (a)  In  General. — Title  XI  of  the  Social  Security  Act 

23  (42  U.S.C.  1301  et  seq.)  is  amended  by  adding  at  the  end 

24  the  following  new  part: 
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1  "PART  C— ADMINISTRATIVE  SIMPLIFICATION 

2  "SEC.  1171.  DEFINITIONS. 

3  "For  purposes  of  this  part: 

4  "(1)  Code  set. — The  term  'code  set'  means 

5  any  set  of  codes  used  for  encoding  data  elements, 

6  such  as  tables  of  terms,  medical  concepts,  medical 

7  diagnostic  codes,  or  medical  procedure  codes. 

8  "(2)  Coordination  of  benefits. — The  term 

9  'coordination  of  benefits'  means  determining  and  co- 

10  ordinating  the  financial  obligations  of  health  plans 

11  when  health  care  benefits  are  payable  under  2  or 

12  more  health  plans. 

13  "(3)  Equivalent  health  care  program. — 

14  The  term  'equivalent  health  care  program'  means — 

15  "(A)  the  health  care  program  for  active 

16  military  personnel  under  title  10,  United  States 

17  Code; 

18  "(B)  the  veterans  health  care  program 

19  under  chapter  17  of  title  38,  United  States 

20  Code; 

21  "(C)  the  Civilian  Health  and  Medical  Pro- 

22  gram  of  the  Uniformed  Services  (CHAMPUS), 

23  as  defined  in  section  1073(4)  of  title  10,  United 

24  States  Code; 
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1  "(D)  the  Indian  health  service  program 

2  under  the  Indian  Health  Care  Improvement  Act 

3  (25  U.S.C.  1601  et  seq.);  and 

4  "(E)  the  Federal  Employees  Health  Bene- 

5  fit  Plan  under  chapter  89  of  title  5,  United 

6  States  Code. 

7  (4)    Health    care    provider. — The  term 

8  'health  care  provider'  includes  a  provider  of  services 

9  (as  defined  in  section  1861(u),  a  provider  of  medical 

10  or  other  health  services   (as  defined  in  section 

11  1861  (s))),  and  any  other  person  furnishing  health 

12  care  services  or  supplies. 

13  "(5)  Health  information. — The  term  'health 

14  information'  means  any  information,  whether  oral  or 

15  recorded  in  any  form  or  medium  that — 

16  "(A)  is  created  or  received  by  a  health  care 

17  provider,  health  plan,  public  health  authority, 

18  employer,  life  insurer,  school  or  university,  or 

19  health  information  network  service;  and 

20  "(B)  relates  to  the  past,  present,  or  future 

21  physical  or  mental  health  or  condition  of  an  in- 

22  dividual,  the  provision  of  health  care  to  an  indi- 

23  vidual,  or  the  past,  present,  or  future  payment 

24  for  the  provision  of  health  care  to  an  individual. 
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1  "(6)  Health  information  network. — The 

2  term  'health  information  network'  means  the  health 

3  information  system  that  is  formed  through  the  appli- 

4  cation  of  the  requirements  and  standards  established 

5  under  this  part. 

6  "(7)  Health  information  network  serv- 

7  ICE. — The  term  'health  information  network  service' 

8  means  a  public  or  private  entity  that — 

9  "(A)  processes  or  facilitates  the  processing 

10  of  nonstandard  data  elements  of  health  infor- 

1 1  mation  into  standard  data  elements; 

12  "(B)  provides  the  means  by  which  persons 

13  may  meet  the  requirements  of  this  part;  or 

14  "(C)  provides  specific  information  process- 

15  ing  services. 

16  "(8)  Health  plan. — The  term  'health  plan' 

17  means  a  plan  which  provides,  or  pays  the  cost  of, 

18  health  benefits.  Such  term  includes  the  following,  or 

19  any  combination  thereof: 

20  "(A)  Part  A  or  part  B  of  the  medicare 

21  program  under  title  XVIII. 

22  "(B)  The  medicaid  program  under  title 

23  XIX. 

24  "(C)  A  medicare  supplemental  policy  (as 

25  defined  in  section  1882(g)(1)). 
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1  "(D)  Coverage  issued  as  a  supplement  to 

2  liability  insurance. 

3  "(E)  General  liability  insurance. 

4  "(F)  Worker's  compensation  or  similar  in- 

5  surance. 

6  "(G)  Automobile  or  automobile  medical  - 

7  payment  insurance. 

8  "(H)  A  long-term  care  policy,  including  a 

9  nursing  home  fixed  indemnity  policy  (unless  the 

10  Secretary  determines  that  such  a  policy  does 

11  not  provide  sufficiently  comprehensive  coverage 

12  of  a  benefit  so  that  the  policy  should  be  treated 

13  as  a  health  plan). 

14  "(I)  A  hospital  or  fixed  indemnity  income- 

15  protection  policy. 

16  "(J)  An  equivalent  health  care  program. 

17  "(K)  An  employee  welfare  benefit  plan,  as 

18  defined  in  section  3(1)  of  the  Employee  Retire- 

19  ment  Income  Security  Act  of  1974  (29  U.S.C. 

20  1002(1)),  but  only  to  the  extent  the  plan  is  es- 

21  tablished  or  maintained  for  the  purpose  of  pro- 

22  viding  health  benefits  and  has  50  or  more  par- 

23  ticipating  employees. 

24  "(L)  An  employee  welfare  benefit  plan  or 

25  any  other  arrangement  which  is  established  or 
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1  maintained  for  the  purpose  of  offering  or  pro- 

2  viding  health  benefits  to  the  employees  of  2  or 

3  more  employers. 

4  "(M)  Such  other  plan  or  arrangement  as 

5  the  Secretary  determines  is  a  health  plan. 

6  "(9)  Individually  identifiable  health  in- 

7  formation. — The   term    'individually  identifiable 

8  health  information'  means  any  information,  includ- 

9  ing  demographic  information  collected  from  an  indi- 

10  vidual,  that — 

11  "(A)  is  created  or  received  by  a  health  care 

12  provider,  health  plan,  employer,  or  health  infor- 

13  mation  network  service;  and 

14  "(B)  relates  to  the  past,  present,  or  future 

15  physical  or  mental  health  or  condition  of  an  in- 

16  dividual,  the  provision  of  health  care  to  an  indi- 

17  vidual,  or  the  past,  present,  or  future  payment 

18  for  the  provision  of  health  care  to  an  individual, 

19  and— 

20  "(i)  identifies  an  individual;  or 

21  "(ii)  with  respect  to  which  there  is  a 

22  reasonable  basis  to  believe  that  the  infor- 

23  mation  can  be  used  to  identify  an  individ- 

24  ual. 
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1  "(10)    Secretary. — The    term  'Secretary' 

2  means  the  Secretary  of  Health  and  Human  Services. 

3  "(11)  Standard  setting  organization. — 

4  The  term  'standard  setting  organization'  means  a 

5  standard   setting-  organization   accredited  by  the 

6  American  National  Standards  Institute  or  any  other 

7  private  organization  (including  the  National  Council 

8  for  Prescription  Drug  Programs  and  the  Health  In- 

9  formation  Standards  Planning  Panel)  that  develops 

10  standards  for  information  transactions,  data  ele- 

1 1  ments,  or  any  other  standard  that  is  necessary  to  or 

12  will  facilitate  the  implementation  of  this  part,  if  the 

13  standard  development  procedures  of  the  organization 

14  are  open  to  the  public  and  are  based  on  a  broad  con- 

15  sensus  of  opinion. 

16  "(12)   Standard   transaction. — The  term 

17  'standard  transaction'  means,  when  referring  to  an 

18  information  transaction   or  to   data   elements  of 

19  health  information,  any  transaction  that  meets  the 

20  requirements    and    implementation  specifications 

21  adopted  by  the  Secretary  under  sections  1172  and 

22  1173. 

23  "SEC.  1172.  GENERAL  REQUIREMENTS  ON  SECRETARY. 

24  "(a)  Adoption  of  Standards. — 
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1  "(1)  In  general. — Pursuant  to  section  1173, 

2  the  Secretary  shall  adopt  standards  for  information 

3  transactions  and  data  elements  of  health  information 

4  and  modifications  to  the  standards  under  this  part 

5  that  are — 

6  "(A)  consistent  with  the  objective  of  reduc- 

7  ing  the  administrative  costs  of  providing  and 

8  paying  for  health  care;  and 

9  "(B)  developed  or  modified  by  a  standards 

10  setting  organization. 

11  "(2)  Additional  standards  under  certain 

12  CONDITIONS. — If  the  Secretary  determines  that  a 

13  standard  developed  or  modified  by  a  standard  set- 

14  ting  organization  is  impractical  and  more  costly  to 

15  implement  than  a  standard  that  is  in  use  and  gen- 

16  erally  accepted,  the  Secretary  may  adopt  the  stand- 

17  ard  that  is  in  use  and  generally  accepted  in  addition 

18  to  the  standard  developed  or  modified  by  the  stand- 

19  ard  setting  organization.  The  Secretary  shall  publish 

20  in  the  Federal  Register  the  analysis  upon  which  the 

21  Secretary  based  the  determination  to  adopt  such  ad- 

22  ditional  standard. 

23  "(3)  Special  rule  relating  to  data  ele- 

24  MENTS. — The  Secretary  may  adopt  or  modify  a 

25  standard  relating  to  data  elements  that  is  different 
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1  from  the  standard  developed  by  a  standard  setting 

2  organization,  if — 

3  "(A)  the  different  standard  or  modification 

4  will  substantially  reduce  administrative  costs  to 

5  health  care  providers  and  health  plans  com- 

6  pared  to  the  alternative;  and 

7  "(B)  the  standard  or  modification  is  pro- 

8  mulgated  in  accordance  with  the  rulemaking 

9  procedures  of  subchapter  III  of  chapter  5  of 

10  title  5,  United  States  Code. 

11  "(b)  Security  Standards  for  Health  Informa- 

12  tion  Network. — 

13  "(1)  In  general. — Each  person,  who  main- 

14  tains  or  transmits  health  information  or  data  ele- 

15  ments  of  health  information  and  is  subject  to  this 

16  part,  shall  maintain  reasonable  and  appropriate  ad- 

17  ministrative,  technical,  and  physical  safeguards — 

18  "(A)  to  ensure  the  integrity  and  confiden- 

19  tiality  of  the  information; 

20  "(B)  to  protect  against  any  reasonably  an- 

21  ticipated — 

22  "(i)  threats  or  hazards  to  the  security 

23  or  integrity  of  the  information;  and 

24  "(ii)  unauthorized  uses  or  disclosures 

25  of  the  information;  and 
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1  "(C)  to  otherwise  ensure  compliance  with 

2  this  part  by  the  officers  and  employees  of  such 

3  person. 

4  "(2)   Security  standards. — The  Secretary 

5  shall  establish  security  standards  and  modifications 

6  to  such  standards  with  respect  to  health  information 

7  network  services,  health  plans,  and  health  care  pro- 

8  viders  that — 

9  "(A)  take  into  account — 

10  "(i)  the  technical  capabilities  of  record 

11  systems  used  to  maintain  health  informa- 

12  tion; 

13  "(ii)  the  costs  of  security  measures; 

14  "(hi)  the  need  for  training  persons 

15  who  have  access  to  health  information; 

16  "(iv)  the  value  of  audit  trails  in  com- 

17  puterized  record  systems;  and 

18  "(v)  the  needs  and  capabilities  of 

19  small   health   care   providers    and  rural 

20  health  care  providers  (as  such  providers 

21  are  defined  by  the  Secretary);  and 

22  "(B)  ensure  that  a  health  information  net- 

23  work  service,  if  it  is  part  of  a  larger  organiza- 

24  tion,  has  policies  and  security  procedures  which 

25  isolate  the  activities  of  such  service  with  respect 
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1  to  processing  information  in  a  manner  that  pre- 

2  vents  unauthorized  access  to  such  information 

3  by  such  larger  organization. 

4  The  security  standards  established  by  the  Secretary 

5  shall  be  based  on  the  standards  developed  or  modi- 

6  fied  by  standard   setting  organizations.   If  such 

7  standards  do  not  exist,  the  Secretary  shall  rely  on 

8  the  recommendations  of  the  Health  Information  Ad- 

9  visory  Committee  and  shall  consult  with  appropriate 

10  government  agencies  and  private  organizations  in  ac- 

11  cordance  with  subsection  (e). 

12  "(c)  Privacy  Standards  for  Health  Informa- 


13  TION  Network. — The  Secretary  shall  establish  standards 

14  and  modifications  to  such  standards  with  respect  to  the 

1 5  privacy  of  individually  identifiable  health  information  that 

16  is  in  the  health  information  network.  Such  standards  shall 

1 7  include  standards  concerning  at  least  the  following: 


18  "(1)  The  rights  of  an  individual  who  is  the  sub- 

19  ject  of  such  information. 

20  "(2)  The  procedures  to  be  established  for  the 

21  exercise  of  such  rights. 

22  "(3)  The  uses  and  disclosures  of  such  informa- 

23  tion  that  are  authorized  or  required. 

24  "(4)  Safeguards  for  the  security  of  such  infor- 

25  mation  and  adequate  security  practices. 
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1  "(d)  Implementation  Specifications. — The  Sec- 

2  retaiy  shall  establish  specifications  for  implementing  each 

3  of  the  standards  and  the  modifications  to  the  standards 

4  adopted  pursuant  to  subsection  (a). 

5  "(e)  Assistance  to  the  Secretary. — In  comply- 

6  ing  with  the  requirements  of  this  part,  the  Secretary  shall 

7  rely  on  recommendations  of  the  Health  Information  Advi- 

8  sory  Committee  established  under  section  1179  and  shall 

9  consult  with  appropriate  Federal  and  State  agencies  and 

10  private  organizations.  The  Secretary  shall  publish  in  the 

11  Federal  Register  the  recommendations  of  the  Health  In- 

12  formation  Advisory  Committee  regarding  the  adoption  of 

13  a  standard  under  this  part. 

14  "SEC.  1173.  STANDARDS  FOR  INFORMATION  TRANSACTIONS 


1 5  AND  DATA  ELEMENTS. 

16  "(a)  In  General. — 

17  "(1)  General  requirements. — The  Secretary 

18  shall  adopt  standards  for  transactions  and  data  ele- 

19  ments  to  make  health  information  uniformly  avail- 

20  able  to  be  exchanged  electronically,  that  is — 

21  "(A)  appropriate  for  the  following  financial 

22  and  administrative  transactions:  claims  (includ- 

23  ing  coordination  of  benefits)  or  equivalent  en- 

24  counter  information,  claims  attachments,  enroll- 

25  ment  and  disenrollment,  eligibility,  health  care 
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1  payment  and  remittance  advice,  premium  pay- 

2  ments,  first  report  of  injury,  claims  status,  and 

3  referral  certification  and  authorization;  and 

4  "(B)  related  to  other  financial  and  admin- 

5  istrative  transactions  determined  appropriate  by 

6  the  Secretary  consistent  with  the  goals  of  im- 

7  proving  the  operation  of  the  health  care  system 

8  and  reducing  administrative  costs. 

9  "(2)  Accommodation  of  specific  provid- 

10  EES. — Nothing  in  this  part  shall  prevent  the  Sec- 

11  retary  from  adopting  standards  that  accommodate 

12  the  specific  needs  of  different  types  of  health  care 

13  providers. 

14  "(b)  Unique  Health  Identifiers. — 

15  "(1)  Adoption  of  standards. — The  Sec- 

16  retary  shall  adopt  standards  providing  for  a  stand- 

17  ard  unique  health  identifier  for  each  individual,  em- 

18  ployer,  health  plan,  and  health  care  provider  for  use 

19  in  the  health  care  system.  In  developing  unique 

20  health  identifiers  for  each  health  plan  and  health 

21  care  provider,  the  Secretary  shall  take  into  account 

22  multiple  uses  for  identifiers  and  multiple  locations 

23  and  specialty  classifications  for  health  care  provid- 

24  ers. 
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1  "(2)    Penalties. — For    provision  regarding 

2  criminal  penalties,  see  section  1177. 

3  "(c)  Code  Sets.— 

4  "(1)  In  general. — The  Secretary,  in  consulta- 

5  tion  with  the  Health  Information  Advisory  Commit- 

6  tee,  experts  from  the  private  sector,  and  Federal  and 

7  State  agencies,  shall — 

8  "(A)  select  code  sets  for  appropriate  data 

9  elements  from  among  the  code  sets  that  have 

10  been  developed  by  private  and  public  entities;  or 

11  "(B)  establish  code  sets  for  such  data  ele- 

12  ments  if  no  code  sets  for  the  data  elements 

13  have  been  developed. 

14  "(2)  Distribution. — The  Secretary  shall  es- 

15  tablish  efficient  and  low-cost  procedures  for  distribu- 

16  tion  (including  electronic  distribution)  of  code  sets 

17  and  modifications  made  to  such  code  sets  under  sec- 

18  tion  1174(b). 

19  "(d)  Electronic  Signature. — 

20  "(1)  In  general. — The  Secretary,  in  coordina- 

21  tion  with  the  Secretary  of  Commerce  and  after  con- 

22  sultation  with   the   Health  Information  Advisory 

23  Committee,  shall  promulgate  regulations  specifying 

24  procedures  for  the  electronic  transmission  and  au- 

25  thentication  of  signatures,  compliance  with  which 
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1  will  be  deemed  to  satisfy  Federal  and  State  statu- 

2  tory  requirements  for  written  signatures  with  respect 

3  to  information  transactions  required  by  this  part 

4  and  written  signatures  on  medical  records  and  pre- 

5  scriptions. 

6  "(2)   Payments  for  services  and  pre- 

7  MIUMS. — Nothing  in  this  part  shall  be  construed  to 

8  prohibit  the  payment  of  health  care  services  or 

9  health  plan  premiums  by  debit,  credit,  payment  card 

10  or  numbers,  or  other  electronic  means. 

11  "(e)    Transfer    of    Information  Between 

12  Health  Plans. — The  Secretary  shall  develop  rules  and 

13  procedures — 

14  "(1)  for  determining  the  financial  liability  of 

15  health  plans  when  health  care  benefits  are  payable 

16  under  two  or  more  health  plans;  and 

17  "(2)  for  transferring  among  health  plans  appro- 

18  priate  standard  data  elements  needed  for  the  coordi- 

19  nation   of  benefits,   the   sequential   processing  of 

20  claims,  and  other  data  elements  for  individuals  who 

21  have  more  than  one  health  plan. 

22  "(f)  Coordination  of  Benefits. — If,  at  the  end  of 

23  the  5 -year  period  beginning  on  the  date  of  the  enactment 

24  of  this  part,  the  Secretary  determines  that  additional 

25  transaction  standards  for  coordinating  benefits  are  nec- 
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1  essary  to  reduce  administrative  costs  or  duplicative  (or  in- 

2  appropriate)  payment  of  claims,  the  Secretary  shall  estab- 

3  lish  further  transaction  standards  for  the  coordination  of 

4  benefits  between  health  plans. 

5  "(g)  Protection  of  Trade  Secrets. — Except  as 

6  otherwise  required  by  law,  the  standards  adopted  under 

7  this  part,  shall  not  require  disclosure  of  trade  secrets  or 

8  confidential  commercial  information  by  an  entity  operat- 

9  ing  a  health  information  network. 

10  "SEC.  1174.  TIMETABLES  FOR  ADOPTION  OF  STANDARDS. 

11  "(a)   Initial   Standards. — Not   later  than  18 

12  months  after  the  date  of  the  enactment  of  this  part,  the 

13  Secretary  shall  adopt  standards  relating  to  the  informa- 

14  tion  transactions,  data  elements  of  health  information,  se- 

15  curity,  and  privacy  described  in  sections  1172  and  1173. 

16  Standards  relating  to  claims  attachments  shall  be  adopted 

17  not  later  than  30  months  after  such  date. 

18  "(b)  Additions  and  Modifications  to  Stand- 

19  ards. — 

20  "(1)  In  general. — Except  as  provided  in  para- 

21  graph  (2),  the  Secretary  shall  review  the  standards 

22  adopted  under  this  part  and  shall  adopt  additional 

23  or  modified  standards,  that  have  been  developed  or 

24  modified  by  a  standard  setting  organization,  as  de- 

25  termined  appropriate,  but  not  more  frequently  than 
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1  once  every  6  months.  Any  addition  or  modification 

2  to  such  standards  shall  be  completed  in  a  manner 

3  which  minimizes  the  disruption  and  cost  of  compli- 

4  ance. 

5  "(2)  Special  rules. — 

6  "(A)  First  12-month  period. — Except 

7  with  respect  to  additions  and  modifications  to 

8  code  sets  under  subparagraph  (B),  the  Sec- 

9  retary  shall  not  adopt  any  modifications  to  the 

10  standards  adopted  under  this  part  during  the 

11  12 -month  period  beginning  on  the  date  such 

12  standards  are  initially  adopted  under  paragraph 

13  (1)  unless  the  Secretary  determines  that  a 

14  modification  is  necessary  in  order  to  permit 

15  compliance  with  requirements  relating  to  the 

16  standards. 

17  "(B)  Additions  and  modifications  to 

18  code  sets. — 

19  "(i)    In    general. — The  Secretary 

20  shall  ensure  that  procedures  exist  for  the 

21  routine  maintenance,  testing,  enhancement, 

22  and  expansion  of  code  sets. 

23  "(ii)  Additional  rules. — If  a  code 

24  set  is  modified  under  this  subsection,  the 

25  modified  code  set  shall  include  instructions 
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1  on  how  data  elements  of  health  informa- 

2  tion  that  were  encoded  prior  to  the  modi- 

3  fication  may  be  converted  or  translated  so 

4  as  to  preserve  the  informational  value  of 

5  the  data  elements  that  existed  before  the 

6  modification.  Any  modification  to  a  code 

7  set  under  this  subsection  shall  be  imple- 

8  mented  in  a  manner  that  minimizes  the 

9  disruption  and  cost  of  complying  with  such 

10  modification. 

1 1  "SEC.  1175.  REQUIREMENTS  FOR  HEALTH  PLANS. 

12  "(a)  In  General. — If  a  person  desires  to  conduct 


13  any  of  the  information  transactions  described  in  section 

14  1173(a)  with  a  health  plan  as  a  standard  transaction,  the 

15  health  plan  shall  conduct  such  standard  transaction  in  a 

16  timely  manner  and  the  information  transmitted  or  re- 

17  ceived  in  connection  with  such  transaction  shall  be  in  the 

1 8  form  of  standard  data  elements  of  health  information. 

19  "(b)  Satisfaction  of  Requirements. — A  health 

20  plan  may  satisfy  the  requirement  imposed  on  such  plan 

21  under  subsection  (a)  by  directly  transmitting  standard 

22  data  elements  of  health  information  or  submitting  non- 
23  standard  data  elements  to  a  health  information  network 

24  service  for  processing  into  standard  data  elements  and 

25  transmission. 
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1  "(e)  Health  Plans  Dealing  With  Persons. — A 

2  health  plan  conducting  an  information  transaction  with  a 

3  person  may  not — 

4  "(1)  adversely  affect  the  time,  manner,  or 

5  amount  of  payment  of  a  claim  because  an  informa- 

6  tion  transaction  is  conducted  as  a  standard  trans- 

7  action  pursuant  to  this  part;  or 

8  "(2)  in  any  other  manner  discourage  the  use  of 

9  a  standard  adopted  under  this  part. 

10  "(d)  Timetables  for  Compliance  With  Re- 

1 1  quirements. — 

12  "(1)  Initial  compliance. — 

13  "(A)  In  general. — Not  later  than  24 

14  months  after  the  date  on  which  standards  are 

15  adopted  under  sections  1172  and  1173  with  re- 

16  spect  to  any  type  of  information  transaction  or 

17  data  element  of  health  information  or  with  re- 

18  spect  to  security  or  privacy,  a  health  plan  shall 

19  comply  with  the  requirements  of  this  part  with 

20  respect  to  such  transaction  or  data  element. 

21  "(B)  Special  rule  for  small  health 

22  PLANS. — In  the  case  of  a  small  health  plan, 

23  paragraph  (1)  shall  be  applied  by  substituting 

24  "36  months"  for  "24  months".  For  purposes  of 
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1  this  subsection,  the  Secretary  shall  determine 

2  the  plans  that  quality  as  small  health  plans. 

3  "(e)  Compliance  With  Modified  Standards. — If 


4  the  Secretary  adopts  a  modified  standard  under  section 

5  1172  or  1173,  a  health  plan  shall  be  required  to  comply 

6  with  the  modified  standard  at  such  time  as  the  Secretary 

7  determines  appropriate  taking  into  account  the  time  need- 

8  ed  to  comply  due  to  the  nature  and  extent  of  the  modifica- 

9  tion.  However,  the  time  determined  appropriate  under  the 

10  preceding  sentence  shall  be  not  earlier  than  the  last  day 

11  of  the  180-day  period  beginning  on  the  date  such  modified 

12  standard  is  adopted.  The  Secretary  may  extend  the  time 

13  for  compliance  for  small  health  plans,  if  the  Secretary  de- 

14  termines  such  extension  is  appropriate. 

15  "SEC.  1176.  GENERAL  PENALTY  FOR  FAILURE  TO  COMPLY 


1 6  WITH  REQUIREMENTS  AND  STANDARDS. 

17  "(a)  General  Penalty. — 

18  "(1)  In  general. — Except  as  provided  in  sub- 

19  section  (b),  the  Secretary  shall  impose  on  any  person 

20  that  violates  a  requirement  or  standard — 

21  "(A)  with  respect  to  information  trans- 

22  actions,  data  elements  of  health  information,  or 

23  security  imposed  under  section  1172  or  1173; 

24  or 
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1  "(B)  with  respect  to  health  plans  imposed 

2  under  section  1175; 

3  a  penalty  of  not  more  than  $100  for  each  such  viola- 

4  tion  of  a  specific  standard  or  requirement,  but  the 

5  total  amount  imposed  for  all  such  violations  of  a 

6  specific  standard  or  requirement  during  the  calendar 

7  year  shall  not  exceed  $25,000. 

8  "(2)  Procedures. — The  provisions  of  section 

9  1128A  (other  than  subsections  (a)  and  (b)  and  the 

10  second  sentence  of  subsection  (f))  shall  apply  to  the 

11  imposition  of  a  civil  money  penalty  under  this  sub- 

12  section  in  the  same  manner  as  such  provisions  apply 

13  to  the  imposition  of  a  penalty  under  such  section 

14  1128A. 

15  "(b)  Limitations. — 

16  "(1)  Noncompliance  not  discovered. — A 

17  penalty  may  not  be  imposed  under  subsection  (a)  if 

18  it  is  established  to  the  satisfaction  of  the  Secretary 

19  that  the  person  liable  for  the  penalty  did  not  know, 

20  and  by  exercising  reasonable  diligence  would  not 

21  have  known,  that  such  person  failed  to  comply  with 

22  the  requirement  or  standard  described  in  subsection 

23  (a). 

24  "(2)  Failures  due  to  reasonable  cause. — 
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1  "(A)  In  general. — Except  as  provided  in 

2  subparagraph  (B),  a  penalty  may  not  be  im- 

3  posed  under  subsection  (a)  if — 

4  "(i)  the  failure  to  comply  was  due  to 

5  reasonable  cause  and  not  to  willful  neglect; 

6  and 

7  "(ii)  the  failure  to  comply  is  corrected 

8  during  the  30-day  period  beginning  on  the 

9  1st  date  the  person  liable  for  the  penalty 

10  knew,  or  by  exercising  reasonable  diligence 

1 1  would  have  known,  that  the  failure  to  com- 

12  ply  occurred. 

13  "(B)  Extension  of  period. — 

14  "(i)  No  PENALTY. — The  period  re- 

15  f erred  to  in  subparagraph  (A)(ii)  may  be 

16  extended  as  determined  appropriate  by  the 

17  Secretary  based  on  the  nature  and  extent 

18  of  the  failure  to  comply. 

19  "(ii)  Assistance. — If  the  Secretary 

20  determines  that  a  health  plan  failed  to 

21  comply  because  such  plan  was  unable  to 

22  comply,  the  Secretary  may  provide  tech- 

23  nical  assistance  to  such  plan  during  the  pe- 

24  riod  described  in  clause  (i).  Such  assist- 
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1  ance  shall  be  provided  in  any  manner  de- 

2  termined  appropriate  by  the  Secretary. 

3  "(3)  Reduction. — In  the  case  of  a  failure  to 

4  comply  which  is  due  to  reasonable  cause  and  not  to 

5  willful  neglect,  any  penalty  under  subsection  (a)  that 

6  is  not  entirely  waived  under  paragraph  (2)  may  be 

7  waived  to  the  extent  that  the  payment  of  such  pen- 

8  alty  would  be  excessive  relative  to  the  compliance 

9  failure  involved. 

10  "SEC.  1177.  WRONGFUL  DISCLOSURE  OF  INDIVIDUALLY 

1 1  IDENTIFIABLE  HEALTH  INFORMATION. 

12  "(a)  OFFENSE. — A  person  who  knowingly — 

13  "(1)  uses  or  causes  to  be  used  a  unique  health 

14  identifier  for  a  purpose  that  is  not  authorized  by  the 

1 5  Secretary; 

16  "(2)  obtains  individually  identifiable  health  in- 

17  formation  relating  to  an  individual  in  violation  of  the 

18  privacy  standards  established  pursuant  to  this  part; 

19  or 

20  "(3)  discloses  individually  identifiable  health  in- 

21  formation  to  another  person  in  violation  of  the  pri- 

22  vacy  standards  established  pursuant  to  this  part, 

23  shall  be  punished  as  provided  in  subsection  (b). 

24  "(b)  Penalties. — A  person  described  in  subsection 

25  (a)  shall— 
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1  "(1)  be  fined  not  more  than  $50,000,  impris- 

2  oned  not  more  than  1  year,  or  both; 

3  "(2)  if  the  offense  is  committed  under  false  pre- 

4  tenses,  be  fined  not  more  than  $100,000,  imprisoned 

5  not  more  than  5  years,  or  both;  and 

6  "(3)  if  the  offense  is  committed  with  intent  to 

7  sell,  transfer,  or  use  individually  identifiable  health 

8  information   for   commercial    advantage,  personal 

9  gain,   or  malicious   harm,   fined   not  more  than 

10  $250,000,  imprisoned  not  more  than  10  years,  or 

1 1  both. 

12  "SEC.  1178.  EFFECT  ON  STATE  LAW. 

13  "(a)  General  Effect. — 

14  "(1)  General  rule. — Except  as  provided  in 

15  paragraph  (2),  a  provision,  requirement,  or  standard 

16  under  this  part  shall  supersede  any  contrary  provi- 

17  sion  of  State  law,  including  a  provision  of  State  law 

18  that  requires  medical  or  health  plan  records  (includ- 

19  ing  billing  information)  to  be  maintained  or  trans- 

20  mitted  in  written  rather  than  electronic  form. 

21  "(2)  Exceptions. — A  provision,  requirement, 

22  or  standard  under  this  part  shall  not  supersede  a 

23  contrary  provision  of  State  law,  if  the  provision  of 

24  State  law — 
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1  "(A)  provides  requirements  or  standards 

2  that  are  more  stringent  than  the  requirements 

3  or  standards  under  this  part  with  respect  to  the 

4  privacy  of  individually  identifiable  health  infor- 

5  mation;  or 

6  "(B)  is  a  provision  the  Secretary  deter- 

7  mines  is  necessary  to  prevent  fraud  and  abuse 

8  with  respect  to  controlled  substances,  or  for 

9  other  purposes. 

10  "(b)  Public  Health  Reporting. — Nothing  in  this 


1 1  part  shall  be  construed  to  invalidate  or  limit  the  authority, 

12  power,  or  procedures  established  under  any  law  providing 

13  for  the  reporting  of  disease  or  injury,  child  abuse,  birth, 

14  or  death,  public  health  surveillance,  or  public  health  inves- 

15  tigation  or  intervention. 

16  "SEC.  1179.  HEALTH  INFORMATION  ADVISORY  COMMITTEE. 


17  "(a)  Establishment. — There  is  established  a  com- 

18  mittee  to  be  known  as  the  Health  Information  Advisory 

19  Committee  (hereafter  in  this  section  referred  to  as  the 

20  'committee'). 

21  "(b)  Duties. — The  committee  shall — 

22  "(1)  provide  assistance  to  the  Secretary  in  com- 

23  plying  with  the  requirements  imposed  on  the  Sec- 

24  retary  under  this  part; 
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1  "(2)  study  the  issues  related  to  the  adoption  of 

2  uniform  data  standards  for  patient  medical  record 

3  information  and  the  electronic  exchange  of  such  in- 

4  formation; 

5  "(3)  report  to  the  Secretary  not  later  than  4 

6  years  after  the  date  of  the  enactment  of  this  part 

7  recommendations  and  legislative  proposals  for  such 

8  standards  and  electronic  exchange;  and 

9  "(4)  be  generally  responsible  for  advising  the 

10  Secretary  and  the  Congress  on  the  status  and  the 

1 1  future  of  the  health  information  network. 

12  "(c)  Membership. — 

13  "(1)  In  general. — The  committee  shall  con- 

14  sist  of  15  members  of  whom —  . 

15  "(A)  3  shall  be  appointed  by  the  President; 

16  "(B)  6  shall  be  appointed  by  the  Speaker 

17  of  the  House  of  Representatives  after  consulta- 

18  tion  with  the  minority  leader  of  the  House  of 

19  Representatives;  and 

20  "(C)  6  shall  be  appointed  by  the  President 

21  pro  tempore  of  the  Senate  after  consultation 

22  with  the  minority  leader  of  the  Senate. 

23  The  appointments  of  the  members  shall  be  made  not 

24  later  than  60  days  after  the  date  of  the  enactment 
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1  of  this  part.  The  President  shall  designate  1  member 

2  as  the  Chair. 

3  "(2)  Expertise. — The  membership  of  the  com- 

4  mittee  shall  consist  of  individuals  who  are  of  recog- 

5  nized  standing  and  distinction  in  the  areas  of  infor- 

6  mation  systems,  information  networking  and  inte- 

7  gration,  consumer  health,  health  care  financial  man- 

8  agement,  or  privacy,  and  who  possess  the  dem- 

9  onstrated  capacity  to  discharge  the  duties  imposed 

10  on  the  committee. 

11  "(3)  Terms. — Each  member  of  the  committee 

12  shall  be  appointed  for  a  term  of  5  years,  except  that 

13  the  members  first  appointed  shall  serve  staggered 

14  terms  such  that  the  terms  of  not  more  than  3  mem- 

15  bers  expire  at  one  time. 

16  "(4)  Initial  meeting. — Not  later  than  30 

17  days  after  the  date  on  which  a  majority  of  the  mem- 

18  bers  have  been  appointed,  the  committee  shall  hold 

19  its  first  meeting. 

20  "(d)  Reports. — Not  later  than  1  year  after  the  date 

21  of  the  enactment  of  this  part,  and  annually  thereafter,  the 

22  committee  shall  submit  a  report  to  Congress,  health  care 

23  providers,  health  plans,  and  other  entities  that  use  the 

24  health  information  network  to  exchange  health  informa- 

25  tion  regarding — 
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1  "(1)  the  extent  to  which  entities  using  the 

2  health  information  network  are  meeting  the  stand- 

3  ards  adopted  under  this  part  and  working  together 

4  to  form  an  integrated  network  that  meets  the  needs 

5  of  its  users; 

6  "(2)  the  extent  to  which  such  entities  are  meet- 

7  ing  the  privacy  and  security  standards  established 

8  pursuant  to  this  part  and  the  types  of  penalties  as- 

9  sessed  for  noncompliance  with  such  standards; 

10  "(3)  whether  the  Federal  and  State  Govern- 

1 1  ments  are  receiving  information  of  sufficient  quality 

12  to  meet  their  responsibilities  under  this  part; 

13  "(4)  any  problems  that  exist  with  respect  to  im- 

14  plementation  of  the  health  information  network;  and 

15  "(5)  the  extent  to  which  timetables  under  this 

16  part  are  being  met. 

17  "SEC.  1180.  STANDARDS  FOR  PATD3NT  MEDICAL  RECORD 

18  INFORMATION. 

19  "The  Secretary  shall,  not  earlier  than  4  years  and 


20  not  later  than  6  years  after  the  date  of  the  enactment  of 

21  this  part  recommend  to  Congress  a  plan  for  developing 

22  and  implementing  uniform  data  standards  for  patient 

23  medical  record  information  and  the  electronic  exchange  of 

24  such  information. 
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1  "SEC.  1181.  GRANTS  FOR  DEMONSTRATION  PROJECTS. 

2  "(a)  In  General. — The  Secretary  may  make  grants 

3  for  demonstration  projects  to  promote  the  development 

4  and  use  of  electronically  integrated  clinical  information 

5  systems  and  computerized  patient  medical  records. 

6  "(b)  Applications. — 

7  "(1)  Submission. — To  apply  for  a  grant  under 

8  this  section  for  any  fiscal  year,  an  applicant  shall 

9  submit  an  application  to  the  Secretary  in  accordance 

10  with  the  procedures  established  by  the  Secretary. 

11  "(2)  Criteria  for  approval. — The  Secretary 

12  may  not  approve  an  application  submitted  under 

13  paragraph  (1)  unless  the  application  includes  assur- 

14  ances  satisfactory  to  the  Secretary  regarding  the  fol- 

15  lowing: 

16  "(A)  Use  op  existing  technology. — 

17  Funds  received  under  this  section  will  be  used 

18  to  apply  telecommunications  and  information 

19  systems  technology  that  is  in  existence  on  the 

20  date  the  application  is  submitted  in  a  manner 

21  that  improves  the  quality  of  health  care,  re- 

22  duces  the  costs  of  such  care,  and  protects  the 

23  privacy  and  confidentiality  of  information  relat- 

24  ing  to  the  physical  or  mental  condition  of  an  in- 

25  dividual. 
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1  "(B)  Use  of  existing  information  sys- 

2  tems. — Funds  received  under  this  section  will 

3  be  used — 

4  "(i)  to  enhance  telecommunications  or 

5  information  systems  that  are  operating  on 

6  the  date  the  application  is  submitted; 

7  "(ii)  to  integrate  telecommunications 

8  or  information  systems  that  are  operating 

9  on  such  date;  or 

10  "(iii)  to  connect  additional  users  to 

11  telecommunications    or    information  net- 

12  works  or  systems  that  are  operating  on 

13  such  date. 

14  "(C)  Matching  funds. — The  applicant 

15  shall  make  available  funds  for  the  demonstra- 

16  tion  project  in  an  amount  that  equals  at  least 

17  50  percent  of  the  cost  of  the  project. 

18  "(c)  Geographic  Diversity. — In  making  grants 


19  under  this  section,  the  Secretary  shall,  to  the  extent  prac- 

20  ticable,  make  grants  to  persons  representing  different  geo- 

21  graphic  areas  of  the  United  States,  including  urban  and 

22  rural  areas. 

23  "(d)  Review  and  Sanctions. — The  Secretary  shall 

24  review  at  least  annually  the  compliance  of  a  person  receiv- 

25  ing  a  grant  under  this  section  with  the  provisions  of  this 
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1  part.  The  Secretary  shall  establish  a  procedure  for  deter- 

2  mining  whether  such  a  person  has  failed  to  comply  sub- 

3  stantially  with  the  provisions  of  this  part  and  the  sanctions 

4  to  be  imposed  for  any  such  noncompliance. 

5  "(e)  Annual  Report. — The  Secretary  shall  submit 

6  an  annual  report  to  the  President  for  transmittal  to  Con- 

7  gress  containing  a  description  of  the  activities  carried  out 

8  under  this  section. 

9  "SEC.  1182.  AUTHORIZATION  OF  APPROPRIATIONS. 


10  "There  are  authorized  to  be  appropriated  such  sums 

11  as  may  be  necessary  to  carry  out  the  purposes  of  this 

12  part.". 

13  (b)  Conforming  Amendments. — 

14  (1)  Requirement  for  medicare  provid- 

15  ers. — Section  1866(a)(1)  of  the  Social  Security  Act 

16  (42  U.S.C.  1395cc(a)(l))  is  amended— 

17  (A)  by  striking  "and"  at  the  end  of  sub- 

18  paragraph  (P); 

19  (B)  by  striking  the  period  at  the  end  of 

20  subparagraph  (Q)  and  inserting  ";  and";  and 

21  (C)  by  inserting  immediately  after  sub- 

22  paragraph  (Q)  the  following  new  subparagraph: 

23  "(R)  to  contract  only  with  a  health  infor- 

24  mation  network  service  (as  defined  in  section 
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1  1171(7))  that  meets  the  standards  established 

2  under  sections  1172  and  1173.". 

3  (2)  Clerical  amendments. — 

4  (A)  Title  XI  of  the  Social  Security  Act  (42 

5  U.S.C.1301et  seq.)  is  amended  by  striking  the 

6  title  and  inserting  the  following: 

7  "TITLE     XI— GENERAL  PROVI- 

8  SIONS,    PEER   REVIEW,  AND 

9  ADMINISTRATIVE  SIM- 

10  PLIFICATION 

1 1  (B)  Parts  A  and  B  of  title  XI  of  the  Social 

12  Security  Act  (42  U.S.C.  1301  et  seq.)  are 

13  amended  by  striking  "this  title"  each  place  it 

14  appears  and  inserting  "parts  A  and  B  of  this 

15  title". 

16  TITLE  III— EFFECTIVE  DATES 

1 7  SEC.  301.  EFFECTIVE  DATES. 

18  (a)  In  General. — Except  as  provided  in  subsection 

19  (b),  the  provisions  of  this  Act  shall  take  effect  on  the  date 

20  of  the  enactment  of  this  Act. 

21  (b)  Repeal  of  Data  Bank. — The  provisions  of  sec- 

22  tion  102  shall  take  effect  on  the  date  the  Secretary  of 

23  Health  and  Human  Services  provides  written  notice  to  the 

24  Congress  that  the  Medicare  and  Medicaid  Coverage  Data 

25  Bank  is  no  longer  necessary  because  of  the  operation  of 
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the  health  information  network  established  pursuant  to 
this  Act. 

O 
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